Security update for java-1_7_1-ibm SUSE Patch security@suse.de SUSE Security Team SUSE-SU-2019:14160-1 Final 1 1 2019-09-04T08:05:57Z current 2019-09-04T08:05:57Z 2019-09-04T08:05:57Z cve-database/bin/generate-cvrf.pl 2017-02-24T01:00:00Z Security update for java-1_7_1-ibm This update for java-1_7_1-ibm fixes the following issues: Update to Java 7.1 Service Refresh 4 Fix Pack 50. Security issues fixed: - CVE-2019-11771: IBM Security Update July 2019 (bsc#1147021) - CVE-2019-11775: IBM Security Update July 2019 (bsc#1147021) - CVE-2019-4473: IBM Security Update July 2019 (bsc#1147021) - CVE-2019-7317: Fixed issue inside Component AWT (libpng)(bsc#1141780). - CVE-2019-2769: Fixed issue inside Component Utilities (bsc#1141783). - CVE-2019-2762: Fixed issue inside Component Utilities (bsc#1141782). - CVE-2019-2816: Fixed issue inside Component Networking (bsc#1141785). - CVE-2019-2766: Fixed issue inside Component Networking (bsc#1141789). The CVRF data is provided by SUSE under the Creative Commons License 4.0 with Attribution (CC-BY-4.0). slessp4-java-1_7_1-ibm-14160 Copyright SUSE LLC under the Creative Commons License 4.0 with Attribution (CC-BY-4.0) https://www.suse.com/support/update/announcement/2019/suse-su-201914160-1/ Link for SUSE-SU-2019:14160-1 https://lists.suse.com/pipermail/sle-security-updates/2019-September/005877.html E-Mail link for SUSE-SU-2019:14160-1 https://www.suse.com/support/security/rating/ SUSE Security Ratings https://bugzilla.suse.com/1141780 SUSE Bug 1141780 https://bugzilla.suse.com/1141782 SUSE Bug 1141782 https://bugzilla.suse.com/1141783 SUSE Bug 1141783 https://bugzilla.suse.com/1141785 SUSE Bug 1141785 https://bugzilla.suse.com/1141789 SUSE Bug 1141789 https://bugzilla.suse.com/1147021 SUSE Bug 1147021 https://www.suse.com/security/cve/CVE-2019-11771/ SUSE CVE CVE-2019-11771 page https://www.suse.com/security/cve/CVE-2019-11775/ SUSE CVE CVE-2019-11775 page https://www.suse.com/security/cve/CVE-2019-2762/ SUSE CVE CVE-2019-2762 page https://www.suse.com/security/cve/CVE-2019-2766/ SUSE CVE CVE-2019-2766 page https://www.suse.com/security/cve/CVE-2019-2769/ SUSE CVE CVE-2019-2769 page https://www.suse.com/security/cve/CVE-2019-2816/ SUSE CVE CVE-2019-2816 page https://www.suse.com/security/cve/CVE-2019-4473/ SUSE CVE CVE-2019-4473 page https://www.suse.com/security/cve/CVE-2019-7317/ SUSE CVE CVE-2019-7317 page SUSE Linux Enterprise Server 11 SP4-LTSS java-1_7_1-ibm-1.7.1_sr4.50-26.44.1 java-1_7_1-ibm-alsa-1.7.1_sr4.50-26.44.1 java-1_7_1-ibm-devel-1.7.1_sr4.50-26.44.1 java-1_7_1-ibm-jdbc-1.7.1_sr4.50-26.44.1 java-1_7_1-ibm-plugin-1.7.1_sr4.50-26.44.1 java-1_7_1-ibm-1.7.1_sr4.50-26.44.1 as a component of SUSE Linux Enterprise Server 11 SP4-LTSS java-1_7_1-ibm-alsa-1.7.1_sr4.50-26.44.1 as a component of SUSE Linux Enterprise Server 11 SP4-LTSS java-1_7_1-ibm-devel-1.7.1_sr4.50-26.44.1 as a component of SUSE Linux Enterprise Server 11 SP4-LTSS java-1_7_1-ibm-jdbc-1.7.1_sr4.50-26.44.1 as a component of SUSE Linux Enterprise Server 11 SP4-LTSS java-1_7_1-ibm-plugin-1.7.1_sr4.50-26.44.1 as a component of SUSE Linux Enterprise Server 11 SP4-LTSS AIX builds of Eclipse OpenJ9 before 0.15.0 contain unused RPATHs which may facilitate code injection and privilege elevation by local users. CVE-2019-11771 SUSE Linux Enterprise Server 11 SP4-LTSS:java-1_7_1-ibm-1.7.1_sr4.50-26.44.1 SUSE Linux Enterprise Server 11 SP4-LTSS:java-1_7_1-ibm-alsa-1.7.1_sr4.50-26.44.1 SUSE Linux Enterprise Server 11 SP4-LTSS:java-1_7_1-ibm-devel-1.7.1_sr4.50-26.44.1 SUSE Linux Enterprise Server 11 SP4-LTSS:java-1_7_1-ibm-jdbc-1.7.1_sr4.50-26.44.1 SUSE Linux Enterprise Server 11 SP4-LTSS:java-1_7_1-ibm-plugin-1.7.1_sr4.50-26.44.1 important To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". https://www.suse.com/support/update/announcement/2019/suse-su-201914160-1/ https://www.suse.com/security/cve/CVE-2019-11771.html CVE-2019-11771 https://bugzilla.suse.com/1147021 SUSE Bug 1147021 All builds of Eclipse OpenJ9 prior to 0.15 contain a bug where the loop versioner may fail to privatize a value that is pulled out of the loop by versioning - for example if there is a condition that is moved out of the loop that reads a field we may not privatize the value of that field in the modified copy of the loop allowing the test to see one value of the field and subsequently the loop to see a modified field value without retesting the condition moved out of the loop. This can lead to a variety of different issues but read out of array bounds is one major consequence of these problems. CVE-2019-11775 SUSE Linux Enterprise Server 11 SP4-LTSS:java-1_7_1-ibm-1.7.1_sr4.50-26.44.1 SUSE Linux Enterprise Server 11 SP4-LTSS:java-1_7_1-ibm-alsa-1.7.1_sr4.50-26.44.1 SUSE Linux Enterprise Server 11 SP4-LTSS:java-1_7_1-ibm-devel-1.7.1_sr4.50-26.44.1 SUSE Linux Enterprise Server 11 SP4-LTSS:java-1_7_1-ibm-jdbc-1.7.1_sr4.50-26.44.1 SUSE Linux Enterprise Server 11 SP4-LTSS:java-1_7_1-ibm-plugin-1.7.1_sr4.50-26.44.1 important To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". https://www.suse.com/support/update/announcement/2019/suse-su-201914160-1/ https://www.suse.com/security/cve/CVE-2019-11775.html CVE-2019-11775 https://bugzilla.suse.com/1147021 SUSE Bug 1147021 Vulnerability in the Java SE, Java SE Embedded component of Oracle Java SE (subcomponent: Utilities). Supported versions that are affected are Java SE: 7u221, 8u212, 11.0.3 and 12.0.1; Java SE Embedded: 8u211. Easily exploitable vulnerability allows unauthenticated attacker with network access via multiple protocols to compromise Java SE, Java SE Embedded. Successful attacks of this vulnerability can result in unauthorized ability to cause a partial denial of service (partial DOS) of Java SE, Java SE Embedded. Note: This vulnerability applies to Java deployments, typically in clients running sandboxed Java Web Start applications or sandboxed Java applets (in Java SE 8), that load and run untrusted code (e.g., code that comes from the internet) and rely on the Java sandbox for security. This vulnerability can also be exploited by using APIs in the specified Component, e.g., through a web service which supplies data to the APIs. CVSS 3.0 Base Score 5.3 (Availability impacts). CVSS Vector: (CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L). CVE-2019-2762 SUSE Linux Enterprise Server 11 SP4-LTSS:java-1_7_1-ibm-1.7.1_sr4.50-26.44.1 SUSE Linux Enterprise Server 11 SP4-LTSS:java-1_7_1-ibm-alsa-1.7.1_sr4.50-26.44.1 SUSE Linux Enterprise Server 11 SP4-LTSS:java-1_7_1-ibm-devel-1.7.1_sr4.50-26.44.1 SUSE Linux Enterprise Server 11 SP4-LTSS:java-1_7_1-ibm-jdbc-1.7.1_sr4.50-26.44.1 SUSE Linux Enterprise Server 11 SP4-LTSS:java-1_7_1-ibm-plugin-1.7.1_sr4.50-26.44.1 important To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". https://www.suse.com/support/update/announcement/2019/suse-su-201914160-1/ https://www.suse.com/security/cve/CVE-2019-2762.html CVE-2019-2762 https://bugzilla.suse.com/1141782 SUSE Bug 1141782 https://bugzilla.suse.com/1147021 SUSE Bug 1147021 Vulnerability in the Java SE, Java SE Embedded component of Oracle Java SE (subcomponent: Networking). Supported versions that are affected are Java SE: 7u221, 8u212, 11.0.3 and 12.0.1; Java SE Embedded: 8u211. Difficult to exploit vulnerability allows unauthenticated attacker with network access via multiple protocols to compromise Java SE, Java SE Embedded. Successful attacks require human interaction from a person other than the attacker. Successful attacks of this vulnerability can result in unauthorized read access to a subset of Java SE, Java SE Embedded accessible data. Note: This vulnerability applies to Java deployments, typically in clients running sandboxed Java Web Start applications or sandboxed Java applets (in Java SE 8), that load and run untrusted code (e.g., code that comes from the internet) and rely on the Java sandbox for security. This vulnerability can also be exploited by using APIs in the specified Component, e.g., through a web service which supplies data to the APIs. CVSS 3.0 Base Score 3.1 (Confidentiality impacts). CVSS Vector: (CVSS:3.0/AV:N/AC:H/PR:N/UI:R/S:U/C:L/I:N/A:N). CVE-2019-2766 SUSE Linux Enterprise Server 11 SP4-LTSS:java-1_7_1-ibm-1.7.1_sr4.50-26.44.1 SUSE Linux Enterprise Server 11 SP4-LTSS:java-1_7_1-ibm-alsa-1.7.1_sr4.50-26.44.1 SUSE Linux Enterprise Server 11 SP4-LTSS:java-1_7_1-ibm-devel-1.7.1_sr4.50-26.44.1 SUSE Linux Enterprise Server 11 SP4-LTSS:java-1_7_1-ibm-jdbc-1.7.1_sr4.50-26.44.1 SUSE Linux Enterprise Server 11 SP4-LTSS:java-1_7_1-ibm-plugin-1.7.1_sr4.50-26.44.1 important To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". https://www.suse.com/support/update/announcement/2019/suse-su-201914160-1/ https://www.suse.com/security/cve/CVE-2019-2766.html CVE-2019-2766 https://bugzilla.suse.com/1141789 SUSE Bug 1141789 https://bugzilla.suse.com/1147021 SUSE Bug 1147021 Vulnerability in the Java SE, Java SE Embedded component of Oracle Java SE (subcomponent: Utilities). Supported versions that are affected are Java SE: 7u221, 8u212, 11.0.3 and 12.0.1; Java SE Embedded: 8u211. Easily exploitable vulnerability allows unauthenticated attacker with network access via multiple protocols to compromise Java SE, Java SE Embedded. Successful attacks of this vulnerability can result in unauthorized ability to cause a partial denial of service (partial DOS) of Java SE, Java SE Embedded. Note: This vulnerability applies to Java deployments, typically in clients running sandboxed Java Web Start applications or sandboxed Java applets (in Java SE 8), that load and run untrusted code (e.g., code that comes from the internet) and rely on the Java sandbox for security. This vulnerability can also be exploited by using APIs in the specified Component, e.g., through a web service which supplies data to the APIs. CVSS 3.0 Base Score 5.3 (Availability impacts). CVSS Vector: (CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L). CVE-2019-2769 SUSE Linux Enterprise Server 11 SP4-LTSS:java-1_7_1-ibm-1.7.1_sr4.50-26.44.1 SUSE Linux Enterprise Server 11 SP4-LTSS:java-1_7_1-ibm-alsa-1.7.1_sr4.50-26.44.1 SUSE Linux Enterprise Server 11 SP4-LTSS:java-1_7_1-ibm-devel-1.7.1_sr4.50-26.44.1 SUSE Linux Enterprise Server 11 SP4-LTSS:java-1_7_1-ibm-jdbc-1.7.1_sr4.50-26.44.1 SUSE Linux Enterprise Server 11 SP4-LTSS:java-1_7_1-ibm-plugin-1.7.1_sr4.50-26.44.1 important To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". https://www.suse.com/support/update/announcement/2019/suse-su-201914160-1/ https://www.suse.com/security/cve/CVE-2019-2769.html CVE-2019-2769 https://bugzilla.suse.com/1141783 SUSE Bug 1141783 https://bugzilla.suse.com/1147021 SUSE Bug 1147021 Vulnerability in the Java SE, Java SE Embedded component of Oracle Java SE (subcomponent: Networking). Supported versions that are affected are Java SE: 7u221, 8u212, 11.0.3 and 12.0.1; Java SE Embedded: 8u211. Difficult to exploit vulnerability allows unauthenticated attacker with network access via multiple protocols to compromise Java SE, Java SE Embedded. Successful attacks of this vulnerability can result in unauthorized update, insert or delete access to some of Java SE, Java SE Embedded accessible data as well as unauthorized read access to a subset of Java SE, Java SE Embedded accessible data. Note: This vulnerability applies to Java deployments, typically in clients running sandboxed Java Web Start applications or sandboxed Java applets (in Java SE 8), that load and run untrusted code (e.g., code that comes from the internet) and rely on the Java sandbox for security. This vulnerability can also be exploited by using APIs in the specified Component, e.g., through a web service which supplies data to the APIs. CVSS 3.0 Base Score 4.8 (Confidentiality and Integrity impacts). CVSS Vector: (CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:N). CVE-2019-2816 SUSE Linux Enterprise Server 11 SP4-LTSS:java-1_7_1-ibm-1.7.1_sr4.50-26.44.1 SUSE Linux Enterprise Server 11 SP4-LTSS:java-1_7_1-ibm-alsa-1.7.1_sr4.50-26.44.1 SUSE Linux Enterprise Server 11 SP4-LTSS:java-1_7_1-ibm-devel-1.7.1_sr4.50-26.44.1 SUSE Linux Enterprise Server 11 SP4-LTSS:java-1_7_1-ibm-jdbc-1.7.1_sr4.50-26.44.1 SUSE Linux Enterprise Server 11 SP4-LTSS:java-1_7_1-ibm-plugin-1.7.1_sr4.50-26.44.1 important To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". https://www.suse.com/support/update/announcement/2019/suse-su-201914160-1/ https://www.suse.com/security/cve/CVE-2019-2816.html CVE-2019-2816 https://bugzilla.suse.com/1141785 SUSE Bug 1141785 https://bugzilla.suse.com/1147021 SUSE Bug 1147021 Multiple binaries in IBM SDK, Java Technology Edition 7, 7R, and 8 on the AIX platform use insecure absolute RPATHs, which may facilitate code injection and privilege elevation by local users. IBM X-Force ID: 163984. CVE-2019-4473 SUSE Linux Enterprise Server 11 SP4-LTSS:java-1_7_1-ibm-1.7.1_sr4.50-26.44.1 SUSE Linux Enterprise Server 11 SP4-LTSS:java-1_7_1-ibm-alsa-1.7.1_sr4.50-26.44.1 SUSE Linux Enterprise Server 11 SP4-LTSS:java-1_7_1-ibm-devel-1.7.1_sr4.50-26.44.1 SUSE Linux Enterprise Server 11 SP4-LTSS:java-1_7_1-ibm-jdbc-1.7.1_sr4.50-26.44.1 SUSE Linux Enterprise Server 11 SP4-LTSS:java-1_7_1-ibm-plugin-1.7.1_sr4.50-26.44.1 important To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". https://www.suse.com/support/update/announcement/2019/suse-su-201914160-1/ https://www.suse.com/security/cve/CVE-2019-4473.html CVE-2019-4473 https://bugzilla.suse.com/1147021 SUSE Bug 1147021 png_image_free in png.c in libpng 1.6.x before 1.6.37 has a use-after-free because png_image_free_function is called under png_safe_execute. CVE-2019-7317 SUSE Linux Enterprise Server 11 SP4-LTSS:java-1_7_1-ibm-1.7.1_sr4.50-26.44.1 SUSE Linux Enterprise Server 11 SP4-LTSS:java-1_7_1-ibm-alsa-1.7.1_sr4.50-26.44.1 SUSE Linux Enterprise Server 11 SP4-LTSS:java-1_7_1-ibm-devel-1.7.1_sr4.50-26.44.1 SUSE Linux Enterprise Server 11 SP4-LTSS:java-1_7_1-ibm-jdbc-1.7.1_sr4.50-26.44.1 SUSE Linux Enterprise Server 11 SP4-LTSS:java-1_7_1-ibm-plugin-1.7.1_sr4.50-26.44.1 low To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". https://www.suse.com/support/update/announcement/2019/suse-su-201914160-1/ https://www.suse.com/security/cve/CVE-2019-7317.html CVE-2019-7317 https://bugzilla.suse.com/1124211 SUSE Bug 1124211 https://bugzilla.suse.com/1135824 SUSE Bug 1135824 https://bugzilla.suse.com/1141780 SUSE Bug 1141780 https://bugzilla.suse.com/1147021 SUSE Bug 1147021 https://bugzilla.suse.com/1165297 SUSE Bug 1165297